Windows Live Mail - Risks Exposed Already

Windows Live Mail's Risks Exposed... Already

Windows 7 will soon be released. It has received rave reviews and is, no doubt, Microsoft's best offering since the release of Windows XP in 2002. Anyone buying a new computer will most likely find Windows 7 pre-installed. All the accolades that tech sites, PC magazines, bloggers, and news media have bestowed on Microsoft's new operating system will stimulate strong demand for Windows 7 upgrade DVDs. And more and more people will begin using Windows 7 during the coming months.

It may well be that Windows 7 is best operating system that Microsoft has released since Windows XP replaced the shoddy, never-should-have-been-released Windows ME - an operating system Microsoft created to fill the gap between Windows 98 and Windows XP - in other words, to make money.

Windows 7 will be well received by the public, but we think Windows 7 has one serious, glaring security flaw - its included email program - Windows Live Mail. Windows Live Mail is a desktop user interface for Hotmail. In order to use it, you must have a Hotmail, MSN, or Live.com account. If you don't have one now, you're going to have to get one if you want to use Windows Live Mail; Windows Live Mail is the only operational email client included in Windows 7 and many users will find themselves using it simply because Microsoft provides it.

Windows Live Mail requires a Hotmail, MSN, or Live.com email address in order to work. You can, after setting up your primary account (your Hotmail, MSN or Live.com account), set up your other email accounts in Windows Live Mail - and those accounts are then synchronized on Microsoft's servers. Your passwords, usernames, and all your messages - synchronized between your desktop computer and Microsoft's servers in the cloud. The benefit, Microsoft says, is that you can access your email accounts wherever you are.

Choosing convenience over security has gotten Microsoft in trouble many times before. You would think, by now, Microsoft would have learned.

We've said since last spring that Windows Live Mail is an accident waiting to happen. There was no justifiable reason for Microsoft to force users of its Windows 7 operating system to use a cloud-based operating system since Windows Mail was included (but not operational) in all pre-release versions of Windows 7. Microsoft could have chosen to do the right thing and give its users a choice between Windows Live Mail and Windows Mail but it did not. It may be a decision that Microsoft will deeply regret in the coming months.

Windows Live Mail is an accident waiting to happen and that accident has already started to happen. The first tremors of the impending disaster that is Windows Live Mail were felt last week when thousands of Windows Live Hotmail, Live.com, and MSN email account holders had their usernames and passwords posted on the Web. Over 10,000 username/password combinations were posted on a Web site - and it was just the tip of the iceberg. These accounts only represented the accounts beginning with the letters A and B. The list was taken down before the rest of the alphabet could be posted. (Please read this article from the "New York Times" http://gadgetwise.blogs.nytimes.com/2009/10/05/hotmail-passwords-stolen/?hp )

Microsoft claims, but does provide any proof, that the passwords/usernames were exposed not via a security breach of its servers, but by phishing schemes which tricked thousands of people into giving up their passwords and usernames.

Microsoft could do the right thing, they could offer Windows 7 users a choice between Windows Live Mail and Windows Mail - but either because of arrogance, greed, or both Microsoft seems to want to monetize its users personal email seemingly without concern for its users' privacy or online safety.

Microsoft points out that Windows 7 users will not be forced to use Windows Live Mail - Microsoft's Outlook is available for $100 or as part of Microsoft Office which can be purchased for $200-$500. Or, users can opt to download and install any of the other email clients available on the Web - some are free. But we've been around long enough to know that the average user will use what Microsoft gives them - Internet Explorer, Outlook Express and Windows Mail (Windows Vista) are all examples.

When we first looked at Windows 7 and its included email client we were disappointed for a lot of reasons - not the least of which is that Windows Live Mail is a very poor email program. It was easy for us to see the inherent risks Microsoft would be exposing Windows Live Mail users to by storing so much personal information on its servers and creating and almost irresistible target for hackers and criminals, who no doubt will find ways to get that valuable information from Windows Live Mail users.

We didn't have to wait long - the preview of the disaster waiting to happen has already started and Microsoft had no response except to place the blame on thousands of users who were tricked into surrendering their passwords and usernames by a "phishing scheme".

Is Microsoft covering up something in order to deflect criticism away from its highly-touted new operating system just days before its release? Or is it displaying that trademark Microsoft attitude - nothing's wrong - but we'll fix it anyway.

We hope Microsoft takes this recent debacle seriously. The theft of tens of thousands of usernames and passwords from its Hotmail, MSN, and Live.com users recently, should be a warning that even worse things are coming. When tens of millions more Windows 7 users are forced to get a Live.com or Hotmail address in order to use the email program included with Windows 7 - things will get worse.

Windows Live Mail is an accident waiting to happen. In fact, the accident has already started.

All content is